The plugin does not have Cross-Site Request Forgery (CSRF) check in place when deleting cursors, which could allow attackers to made a logged in admin delete arbitrary cursors via a Cross-Site Request Forgery (CSRF) attack.

Proof of Concept

POST /wp-admin/admin.php?page=wp_custom_cursors HTTP/1.1
Host: localhost
Content-Type: application/x-www-form-urlencoded


This will make them delete the cursor with ID 1.